feat(pages): publish the canonical www bundle

.github/workflows/casket-pages.yml

@@ -97,6 +97,32 @@ jobs:
           mkdir -p _site
           cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
           touch ../_site/.nojekyll
+      - name: Overlay the canonical www bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Publish the canonical bundle alongside whatever the SSG produced.
+          #
+          #   www/public/      -> the servable site root
+          #   www/.well-known/ -> must be reachable at /.well-known/ on this
+          #                       origin (RFC 9116, and RSR check
+          #                       www/.well-known/security.txt)
+          #
+          # Everything else under www/ (dns/, policies/, profiles/, runbooks/,
+          # errors/) is source material and is deliberately NOT published, so
+          # only these two subtrees are copied rather than all of www/.
+          #
+          # Deliberately additive: the generated site is left intact, so this
+          # cannot regress the existing pages.
+          if [ -d www/public ]; then
+            cp -a www/public/. _site/
+          fi
+          if [ -d www/.well-known ]; then
+            mkdir -p _site/.well-known
+            cp -a www/.well-known/. _site/.well-known/
+          fi
+          echo "published tree:"
+          find _site -maxdepth 2 | sort
 
       - name: Setup Pages
         uses: actions/configure-pages@v5.0.0